9b6bcaa0fa
Audited README.md and all 35 documentation/*.md against main. Script names and markdown links were already clean — 59 documented scripts all exist in package.json, 0 broken links. What was wrong was file-map.md describing files that no longer exist, and three paths that had moved. REMOVED, all archived inafb998f17or earlier and still documented as current: internal/staging.js — the repo-root staging page; the plugin studio is the only entry now index.html — the same page's HTML library/composables/useDoxaSearch.js — deleted inea0c47b27, and dropped from a prose list too REPOINTED: the three colour strategies documented under plugin-designs/doxa-research-map/src/colors/ live in library/colors/. THIRD-PARTY.md's two vendored files live under data/vendor/. embeddability.md's reference to the staging script now says it was archived and where the entry is. WHAT I DID NOT "FIX", because it was not broken: ~20 relative shorthand paths in the architecture docs (`composables/useMapData.js` inside a document about library/) read correctly in context, and three paths name things that are not repo files at all — a runtime endpoint (public/api/maps/token.json), a generated artifact (out/_records.json) and a placeholder (./bundle/bundle.js). Reporting those as defects would have buried the five real ones in 23 false positives. TWO MEASUREMENT TRAPS I fell into on the way, both corrected before reporting: my first env-var scan grepped only internal/, plugin-designs/ and library/ and declared 13 documented env vars unread — 11 of them are read in internal/build-lock.sh, .env.example, deployment/cloud/Dockerfile and the Go backend. And an earlier sweep of my own data files reported six "rega" hits that were all the word "aggregates".
6.5 KiB
Third-party content in the shipped tree
Every non-original thing dx-maps/ ships, what licenses it, and whether the licence or
attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the
source lists -- the question is what a recipient receives.
Notes live HERE and not beside the assets: check:public-hygiene fails on "documentation in a
served folder". The licence travels with the asset; the explanation travels with the repo.
| Item | Source | Licence | Does it travel? | Gap |
|---|---|---|---|---|
| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | Yes — each LICENSE is the family's own upstream OFL, verbatim, with its real copyright line |
none (closed 2026-09-28) |
data/vendor/vue/vue.global.prod.js |
vuejs/core | MIT | Partly — the minified banner carries (c) 2018-present Yuxi (Evan) You and @license MIT, but NOT the permission notice MIT asks to include |
closed: upstream LICENSE now vendored beside it |
data/vendor/tabulator/tabulator.min.js + .min.css |
olifolkerd/tabulator v6.3.1 | MIT | No — the .js had only (c) Oliver Folkerd 2025; the .css had nothing |
closed: upstream LICENSE now vendored beside it |
boundaries/gb-IND-ADM1*.geojson (4 files) |
geoBoundaries gbOpen, boundaryID IND-ADM1-1811400 |
CC BY 2.5 IN, licenceSource github.com/datameet/maps, year 2011 — fetched verbatim from the geoBoundaries API |
Yes — boundaries/ATTRIBUTION now ships beside the data, plus the existing .meta.json sidecar |
none (closed 2026-09-28) |
boundaries/gb-CHN-ADM1.geojson |
geoBoundaries gbOpen, boundaryID CHN-ADM1-43563684 |
Public Domain, licenceSource commons.wikimedia.org, year 2019 |
recorded in boundaries/ATTRIBUTION |
none — upstream records no attribution duty |
boundaries/world-adm0*.geojson (2 files, 162 countries) |
geoBoundaries gbOpen, assembled per country (its features carry geoBoundaries' own iso3/shapeGroup/shapeName; corrected — this register first guessed Natural Earth) |
MIXED, and ESTABLISHED per country as of 2026-09-28: 162 upstream licences. 32 duty-free (28 Public Domain + 4 CC0) · 65 attribution-only · 65 SHARE-ALIKE CLASS (58 ODbL 1.0 + 7 explicit ShareAlike: AGO GAB GEO GIN MMR NER TUR) | Yes — the per-country table (licence + licenseSource + boundaryID + boundarySource, fetched verbatim from the geoBoundaries API, 162 of 162, 0 failures) ships at plugin-designs/my-upg-100-list/data/adm0/PROVENANCE.json. boundaries/ATTRIBUTION references it by path rather than copying it |
OPEN, legal — not a measurement: whether a redistributed boundary file is a "Derivative Database" under ODbL is unanswered, and half the duty-bearing countries turn on it. With the Driver's data-licensing item |
people-groups/* (3 files, 8 MB) |
peoplegroups.org | not established | no terms ship | OPEN, judgment — redistribution terms unknown |
pplr/* (6 files, 16 MB) |
PPLR ArcGIS Online org services2.arcgis.com/S4ydGgujXcif36k3, aggregating IMB (peoplegroups.org), Joshua Project, the ROP registry, and carrying WCD (World Christian Database) IDs. Built from a local 78 MB extract not present in this repo — evidence from exp-shepherd |
UNRESOLVED. aCountry and aIMBPeople publish no copyrightText, description or licence (queried f=json) |
nothing ships | OPEN, judgment — redistribution not established. WCD is a proprietary Brill database, so even the IDs need a check |
tables/* (304 files, 36 MB) |
derived by library/scripts/research/fetch-*.mjs from several upstream APIs |
varies, not established per table | nothing ships; there is no source or licence doc in tables/ |
OPEN, judgment — the largest gap by volume |
images/worldmap.svg |
recorded in images/PROVENANCE |
see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed |
previews/* (378 files) |
our own poster previews | ours | n/a | none |
Natural Earth 1:10m populated places (library/scripts/posters/data/ne-places.json) |
naturalearthdata.com | public domain, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation |
Provenance records
| Vendored file | Upstream URL | sha256 |
|---|---|---|
data/boundaries/ATTRIBUTION |
geoBoundaries API, per boundary (values verbatim) | see the file |
data/vendor/tabulator/LICENSE |
https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE |
191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7 |
data/vendor/vue/LICENSE |
https://raw.githubusercontent.com/vuejs/core/main/LICENSE |
49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac |
data/fonts/bebas-neue/LICENSE |
https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt |
see documentation/vendored-fonts.md |
data/fonts/poppins/LICENSE |
https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt |
see documentation/vendored-fonts.md |
What is NOT closed, and why it is not mine to close
★ ONE FACT IN THIS FILE IS ALSO ASSERTED ELSEWHERE, AND THAT IS WHERE IT WILL DRIFT. The world-adm0
licence counts appear both here and in plugin-designs/my-upg-100-list/data/adm0/PROVENANCE.json.
That file is the authority; if the two disagree, it wins. They have already drifted once: this
register said the licence table was EMPTY on the very commit where it held all 162, because the two
landings crossed and neither author could see the other's tree. A register that still reads
"unestablished" after the work is done is settled-by-omission in reverse — the absence of an update
reads as the absence of the work.
Three rows above are marked OPEN. One is simply unverified and someone should look
(the pplr upstream). Two need a decision rather than a fetch:
people-groups and the 304 tables carry data whose redistribution terms are not established,
and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not
confirmed would be worse than the present gap, so those go to the Driver.
The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to
accompany the data, and the pattern already exists in this repo -- the .meta.json sidecar. Extending
it to the other boundary files plus one shipped attribution line would close it.